Wireless security protocol, WEP, is everywhere in Wi-Fi networks and just got quicker and easier for hackers to break into.

Warnings">

"Ironically, last May, when Bittau, Handley and Lackey released their research showing new flaws in WEP, I remember calling that the final nail in the coffin and the end of the road for WEP," he said in an e-mail exchange. "But it seems that no matter how bad we think WEP is, the news can always be worse than we imagined."

And still, WEP enjoys wide deployment.

In Battau's May 2006 paper, the researchers detail their survey of 400 wireless networks in London and 2,539 networks in the Seattle area. Although more secure protocols existWPA and 802.11ithe researchers found that few networks use them.

"In both cases, about half of the networks used encryption," according to the paper. "In London, 76 percent of the encrypted networks in our sample used WEP, and in Seattle 85 percent of them used WEP. Although vendors recommend upgrading to WPA or 802.11i, only a minority of users seem to use these solutions."

But as Wi-Fi networking equipment vendors will tell you, there's no way to walk away from WEP with all the legacy laptops and network cards still around that use the encryption scheme.

Som Pal Choudhury, Netgear's product line manager, advanced wireless, said in an interview that, like many, WPA and WPA2 are default encryption schemes in the company's routers and that Netgear's reference and setup manuals all explain the dangers of WEP.

In fact, the Wi-Fi Alliance as of March 2006 mandated WPA2 for all new devices in order to be Wi-Fi Alliance certified.

Still, Pal Choudhury said, there are "Legacy drivers, legacy devices out there you buy a laptop for three to five years. If you bought in 2002, 2003, it used to only support WEP. Now, with the second generation of laptops you're going to buy, these are all going to be WPA, WPA2."

In the meantime, Wi-Fi security experts agree that the new WEP cracking techniques should be a wake-up call for equipment manufacturers to make defaults more secure and to make the security features easier to use.

"Perhaps this will lead people to totally abandon WEP and switch to something else," Battau said. "Frankly, however, I think that WEP will still be around for a while due to ignorance. It has received much publicity in academic papers, but there was no response. We will now see what the response will be when a one-click tool for breaking WEP in 10 minutes becomes available."

Lisa Vaas is News Editor/Operations for eWEEK.com and also serves as editor of the Database topic center. Since 1995, she has also been a Webcast news show anchorperson and a reporter covering the IT industry. She has focused on customer relationship management technology, IT salaries and careers, effects of the H1-B visa on the technology workforce, wireless technology, security, and, most recently, databases and the technologies that touch upon them. Her articles have appeared in eWEEK's print edition, on eWEEK.com, and in the startup IT magazine PC Connection. Prior to becoming a journalist, Vaas experienced an array of eye-opening careers, including driving a cab in Boston, photographing cranky babies in shopping malls, selling cameras, typography and computer training. She stopped a hair short of finishing an M.A. in English at the University of Massachusetts in Boston. She earned a B.S. in Communications from Emerson College. She runs two open-mic reading series in Boston and currently keeps bees in her home in Mashpee, Mass.